Stored Cross-Site Scripting Vulnerability in Prime Slider Plugin for WordPress

CVE-2026-111111

What is CVE-2026-111111?

The Prime Slider plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability due to improper input validation and insufficient output escaping of user-supplied data in the 'comment' parameter. This issue affects all versions up to and including 4.7.2. Attackers can exploit this vulnerability to inject malicious scripts into webpages, which will execute when unwitting users visit affected pages. The vulnerability arises because the native wp_filter_kses function fails to adequately process certain submitted markup, allowing attackers to elevate previously non-executable content into active HTML attributes that get stored in the database. Consequently, this poses a significant risk for users accessing affected pages without proper sanitization mechanisms in place.

References